Overview
overview
10Static
static
3ggpermV3/A...64.exe
windows7-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows7-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows7-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows7-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows7-x64
ggpermV3/T...er.exe
windows10-2004-x64
ggpermV3/a...64.sys
windows7-x64
1ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows7-x64
3ggpermV3/ggpermV3.exe
windows10-2004-x64
3ggpermV3/m...er.bat
windows7-x64
3ggpermV3/m...er.bat
windows10-2004-x64
3ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/woof.bat
windows7-x64
8ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09-11-2024 22:49
241109-2r2veatfrl 1009-11-2024 22:47
241109-2qkjqssrdz 1009-11-2024 22:46
241109-2p2fvstfqj 1009-11-2024 22:44
241109-2nsgkasrbt 1007-11-2024 16:00
241107-tfl1taxpgl 1010-02-2024 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 22:47
Static task
static1
Behavioral task
behavioral1
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ggpermV3/Final_Cleaner.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
ggpermV3/Siticone.UI.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ggpermV3/amifldrv64.sys
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
ggpermV3/ggpermV3.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
ggpermV3/macchanger.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
ggpermV3/woof.bat
Resource
win7-20240903-en
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1720 sc.exe 2692 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 632 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 26 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1524 1152 cmd.exe 32 PID 1152 wrote to memory of 1524 1152 cmd.exe 32 PID 1152 wrote to memory of 1524 1152 cmd.exe 32 PID 1152 wrote to memory of 1972 1152 cmd.exe 33 PID 1152 wrote to memory of 1972 1152 cmd.exe 33 PID 1152 wrote to memory of 1972 1152 cmd.exe 33 PID 1152 wrote to memory of 492 1152 cmd.exe 34 PID 1152 wrote to memory of 492 1152 cmd.exe 34 PID 1152 wrote to memory of 492 1152 cmd.exe 34 PID 1152 wrote to memory of 2092 1152 cmd.exe 35 PID 1152 wrote to memory of 2092 1152 cmd.exe 35 PID 1152 wrote to memory of 2092 1152 cmd.exe 35 PID 1152 wrote to memory of 2480 1152 cmd.exe 36 PID 1152 wrote to memory of 2480 1152 cmd.exe 36 PID 1152 wrote to memory of 2480 1152 cmd.exe 36 PID 1152 wrote to memory of 1648 1152 cmd.exe 37 PID 1152 wrote to memory of 1648 1152 cmd.exe 37 PID 1152 wrote to memory of 1648 1152 cmd.exe 37 PID 1152 wrote to memory of 2552 1152 cmd.exe 38 PID 1152 wrote to memory of 2552 1152 cmd.exe 38 PID 1152 wrote to memory of 2552 1152 cmd.exe 38 PID 1152 wrote to memory of 2208 1152 cmd.exe 39 PID 1152 wrote to memory of 2208 1152 cmd.exe 39 PID 1152 wrote to memory of 2208 1152 cmd.exe 39 PID 1152 wrote to memory of 2716 1152 cmd.exe 40 PID 1152 wrote to memory of 2716 1152 cmd.exe 40 PID 1152 wrote to memory of 2716 1152 cmd.exe 40 PID 1152 wrote to memory of 2464 1152 cmd.exe 41 PID 1152 wrote to memory of 2464 1152 cmd.exe 41 PID 1152 wrote to memory of 2464 1152 cmd.exe 41 PID 1152 wrote to memory of 2256 1152 cmd.exe 42 PID 1152 wrote to memory of 2256 1152 cmd.exe 42 PID 1152 wrote to memory of 2256 1152 cmd.exe 42 PID 1152 wrote to memory of 2732 1152 cmd.exe 43 PID 1152 wrote to memory of 2732 1152 cmd.exe 43 PID 1152 wrote to memory of 2732 1152 cmd.exe 43 PID 1152 wrote to memory of 2780 1152 cmd.exe 44 PID 1152 wrote to memory of 2780 1152 cmd.exe 44 PID 1152 wrote to memory of 2780 1152 cmd.exe 44 PID 1152 wrote to memory of 2904 1152 cmd.exe 45 PID 1152 wrote to memory of 2904 1152 cmd.exe 45 PID 1152 wrote to memory of 2904 1152 cmd.exe 45 PID 1152 wrote to memory of 2916 1152 cmd.exe 46 PID 1152 wrote to memory of 2916 1152 cmd.exe 46 PID 1152 wrote to memory of 2916 1152 cmd.exe 46 PID 1152 wrote to memory of 2920 1152 cmd.exe 47 PID 1152 wrote to memory of 2920 1152 cmd.exe 47 PID 1152 wrote to memory of 2920 1152 cmd.exe 47 PID 1152 wrote to memory of 2776 1152 cmd.exe 48 PID 1152 wrote to memory of 2776 1152 cmd.exe 48 PID 1152 wrote to memory of 2776 1152 cmd.exe 48 PID 1152 wrote to memory of 2748 1152 cmd.exe 49 PID 1152 wrote to memory of 2748 1152 cmd.exe 49 PID 1152 wrote to memory of 2748 1152 cmd.exe 49 PID 1152 wrote to memory of 2628 1152 cmd.exe 50 PID 1152 wrote to memory of 2628 1152 cmd.exe 50 PID 1152 wrote to memory of 2628 1152 cmd.exe 50 PID 1152 wrote to memory of 2196 1152 cmd.exe 51 PID 1152 wrote to memory of 2196 1152 cmd.exe 51 PID 1152 wrote to memory of 2196 1152 cmd.exe 51 PID 1152 wrote to memory of 2812 1152 cmd.exe 52 PID 1152 wrote to memory of 2812 1152 cmd.exe 52 PID 1152 wrote to memory of 2812 1152 cmd.exe 52 PID 1152 wrote to memory of 2784 1152 cmd.exe 53
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 14121886931524228452⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 79061077516440128072⤵PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 280901591923895155392⤵PID:492
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 2375991802937929032⤵PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 7542206011753296572⤵PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 23781119493164754652⤵PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 12335108964593293612⤵PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 31862187037100224592⤵PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 121232011325562234762⤵PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 23482145553599317762⤵PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 373341441321259022⤵PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 287492143711792231972⤵PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 156013331122199032⤵PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 10159607311837220772⤵PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 32071179148603245712⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 659550252421324302⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 13203223928025311472⤵PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 192818096798171052⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 253161947816244304422⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 1322603514943207662⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 10824295752119062812⤵PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 8044148912967182542⤵PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 26695235321764521882⤵PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 8829174523040496002⤵PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 23926250949260119462⤵PID:1860
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵PID:2868
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:2796
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵PID:2492
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:1272
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:1720
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:2692
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:632
-